]> git.ipfire.org Git - thirdparty/kernel/linux.git/commit
bpf: Add bpf_prog_run_data_pointers()
authorEric Dumazet <edumazet@google.com>
Wed, 12 Nov 2025 12:55:16 +0000 (12:55 +0000)
committerMartin KaFai Lau <martin.lau@kernel.org>
Fri, 14 Nov 2025 16:56:49 +0000 (08:56 -0800)
commit4ef92743625818932b9c320152b58274c05e5053
treeac7496f64ff667fb3e3ac174206724073ef2182b
parent91a78ce994e710f2e983071ccf6d0e60fc9c1ac5
bpf: Add bpf_prog_run_data_pointers()

syzbot found that cls_bpf_classify() is able to change
tc_skb_cb(skb)->drop_reason triggering a warning in sk_skb_reason_drop().

WARNING: CPU: 0 PID: 5965 at net/core/skbuff.c:1192 __sk_skb_reason_drop net/core/skbuff.c:1189 [inline]
WARNING: CPU: 0 PID: 5965 at net/core/skbuff.c:1192 sk_skb_reason_drop+0x76/0x170 net/core/skbuff.c:1214

struct tc_skb_cb has been added in commit ec624fe740b4 ("net/sched:
Extend qdisc control block with tc control block"), which added a wrong
interaction with db58ba459202 ("bpf: wire in data and data_end for
cls_act_bpf").

drop_reason was added later.

Add bpf_prog_run_data_pointers() helper to save/restore the net_sched
storage colliding with BPF data_meta/data_end.

Fixes: ec624fe740b4 ("net/sched: Extend qdisc control block with tc control block")
Reported-by: syzbot <syzkaller@googlegroups.com>
Closes: https://lore.kernel.org/netdev/6913437c.a70a0220.22f260.013b.GAE@google.com/
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: Martin KaFai Lau <martin.lau@kernel.org>
Reviewed-by: Victor Nogueira <victor@mojatatu.com>
Acked-by: Jamal Hadi Salim <jhs@mojatatu.com>
Link: https://patch.msgid.link/20251112125516.1563021-1-edumazet@google.com
include/linux/filter.h
net/sched/act_bpf.c
net/sched/cls_bpf.c